Add launch hardening gates

tests/integration_smoke.rs

@@ -1495,6 +1495,69 @@ fn resume_updates_udp_endpoint_for_roaming() {
     );
 }
 
+#[test]
+#[ignore = "30-minute launch soak; run with `DOSH_SOAK_SECONDS=1800 cargo test --test integration_smoke sleep_roaming_soak_30m -- --ignored --nocapture`"]
+fn sleep_roaming_soak_30m() {
+    let soak_secs = std::env::var("DOSH_SOAK_SECONDS")
+        .ok()
+        .and_then(|value| value.parse::<u64>().ok())
+        .unwrap_or(30 * 60);
+    let dir = tempfile::tempdir().unwrap();
+    let port = free_udp_port();
+    let config = write_server_config_with_timeout(&dir, port, soak_secs + 60);
+    let mut server = start_server(&dir, &config);
+    let (_old_socket, bootstrap, ok) = direct_attach(&config, port, "read-write");
+
+    thread::sleep(Duration::from_secs(soak_secs));
+
+    let resumed = UdpSocket::bind("127.0.0.1:0").unwrap();
+    resumed
+        .set_read_timeout(Some(Duration::from_secs(3)))
+        .unwrap();
+    let resume = ResumeRequest {
+        session: "default".to_string(),
+        last_rendered_seq: ok.initial_seq,
+        cols: 80,
+        rows: 24,
+    };
+    send_encrypted(
+        &resumed,
+        port,
+        PacketKind::ResumeRequest,
+        ok.client_id,
+        1,
+        0,
+        &bootstrap.session_key,
+        &protocol::to_body(&resume).unwrap(),
+    );
+    let (_header, resume_frame) =
+        recv_frame(&resumed, &bootstrap.session_key).expect("resume response after soak");
+    assert!(resume_frame.snapshot);
+
+    send_encrypted(
+        &resumed,
+        port,
+        PacketKind::Input,
+        ok.client_id,
+        2,
+        resume_frame.output_seq,
+        &bootstrap.session_key,
+        &protocol::to_body(&Input {
+            bytes: b"printf DOSH_SOAK_OK\\n\n".to_vec(),
+        })
+        .unwrap(),
+    );
+    let text = collect_frame_text(&resumed, &bootstrap.session_key, 3000);
+
+    let _ = server.kill();
+    let _ = server.wait();
+
+    assert!(
+        text.contains("DOSH_SOAK_OK"),
+        "session did not survive {soak_secs}s idle/roaming soak; output={text:?}"
+    );
+}
+
 #[test]
 fn transport_rekey_round_trip_keeps_session_alive() {
     use dosh::native::derive_rekey_session_key;